Hi Mao,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 27399521743732e65e7635fa93bd0cca53981c9e
commit: 1c30433d9fa5c5b48039990ba214c0e8e199a22d [5435/23883] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()
config: x86_64-randconfig-071-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290956.flJi6dhy-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290956.flJi6dhy-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202410290956.flJi6dhy-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/tty/serial/sc16is7xx.c: In function 'sc16is7xx_init':
>> drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used [-Wunused-label]
1501 | err_i2c:
| ^~~~~~~
drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_get()+0x104: sibling call from callable instruction with modified stack frame
drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_direction_input()+0x13: sibling call from callable instruction with modified stack frame
drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_set()+0x105: sibling call from callable instruction with modified stack frame
drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_direction_output()+0x2ba: sibling call from callable instruction with modified stack frame
drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_set_baud()+0xdf: sibling call from callable instruction with modified stack frame
vim +/err_i2c +1501 drivers/tty/serial/sc16is7xx.c
1487
1488 #ifdef CONFIG_SERIAL_SC16IS7XX_SPI
1489 ret = spi_register_driver(&sc16is7xx_spi_uart_driver);
1490 if (ret < 0) {
1491 pr_err("failed to init sc16is7xx spi --> %d\n", ret);
1492 goto err_spi;
1493 }
1494 #endif
1495 return ret;
1496
1497 err_spi:
1498 #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
1499 i2c_del_driver(&sc16is7xx_i2c_uart_driver);
1500 #endif
> 1501 err_i2c:
1502 uart_unregister_driver(&sc16is7xx_uart);
1503 return ret;
1504 }
1505 module_init(sc16is7xx_init);
1506
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Andreas,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 27399521743732e65e7635fa93bd0cca53981c9e
commit: 484798bc8218ce6a0f8269675897b870a12c49e2 [8359/23883] gfs2: gfs2_walk_metadata fix
config: x86_64-buildonly-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290938.ovb4D3kI-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290938.ovb4D3kI-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202410290938.ovb4D3kI-lkp@intel.com/
Note: it may well be a FALSE warning. FWIW you are at least aware of it now.
http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings
All warnings (new ones prefixed by >>):
fs/gfs2/bmap.c: In function 'gfs2_iomap_alloc':
fs/gfs2/bmap.c:748:28: warning: this statement may fall through [-Wimplicit-fallthrough=]
748 | if (n == 0)
| ^
fs/gfs2/bmap.c:751:17: note: here
751 | case ALLOC_GROW_DEPTH:
| ^~~~
fs/gfs2/bmap.c:759:28: warning: this statement may fall through [-Wimplicit-fallthrough=]
759 | if (n == 0)
| ^
fs/gfs2/bmap.c:762:17: note: here
762 | case ALLOC_DATA:
| ^~~~
fs/gfs2/bmap.c: In function 'gfs2_iomap_get':
>> fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized [-Wmaybe-uninitialized]
960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/gfs2/bmap.c:851:18: note: 'lblock' was declared here
851 | sector_t lblock;
| ^~~~~~
fs/gfs2/bmap.c:960:31: warning: 'len' may be used uninitialized [-Wmaybe-uninitialized]
960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/gfs2/bmap.c:855:13: note: 'len' was declared here
855 | u64 len;
| ^~~
fs/gfs2/bmap.c:959:32: warning: 'height' may be used uninitialized [-Wmaybe-uninitialized]
959 | if (pos < size && height == ip->i_height)
| ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
fs/gfs2/bmap.c:857:12: note: 'height' was declared here
857 | u8 height;
| ^~~~~~
fs/gfs2/bmap.c:1290: warning: Function parameter or member 'inode' not described in 'gfs2_block_zero_range'
fs/gfs2/bmap.c:1290: warning: Function parameter or member 'from' not described in 'gfs2_block_zero_range'
fs/gfs2/bmap.c:1290: warning: Function parameter or member 'length' not described in 'gfs2_block_zero_range'
fs/gfs2/bmap.c:1493: warning: Function parameter or member 'rd_gh' not described in 'sweep_bh_for_rgrps'
fs/gfs2/bmap.c:1493: warning: Excess function parameter 'rg_gh' description in 'sweep_bh_for_rgrps'
fs/gfs2/bmap.c:1661: warning: Function parameter or member 'sdp' not described in 'find_nonnull_ptr'
fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_list' not described in 'find_nonnull_ptr'
fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_aligned' not described in 'find_nonnull_ptr'
vim +/lblock +960 fs/gfs2/bmap.c
7ee66c03e40a57 Christoph Hellwig 2018-06-01 831
3974320ca6aa68 Bob Peterson 2017-02-16 832 /**
628e366df11c0a Andreas Gruenbacher 2018-06-04 833 * gfs2_iomap_get - Map blocks from an inode to disk blocks
3974320ca6aa68 Bob Peterson 2017-02-16 834 * @inode: The inode
3974320ca6aa68 Bob Peterson 2017-02-16 835 * @pos: Starting position in bytes
3974320ca6aa68 Bob Peterson 2017-02-16 836 * @length: Length to map, in bytes
3974320ca6aa68 Bob Peterson 2017-02-16 837 * @flags: iomap flags
3974320ca6aa68 Bob Peterson 2017-02-16 838 * @iomap: The iomap structure
628e366df11c0a Andreas Gruenbacher 2018-06-04 839 * @mp: The metapath
3974320ca6aa68 Bob Peterson 2017-02-16 840 *
3974320ca6aa68 Bob Peterson 2017-02-16 841 * Returns: errno
3974320ca6aa68 Bob Peterson 2017-02-16 842 */
628e366df11c0a Andreas Gruenbacher 2018-06-04 843 static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,
628e366df11c0a Andreas Gruenbacher 2018-06-04 844 unsigned flags, struct iomap *iomap,
628e366df11c0a Andreas Gruenbacher 2018-06-04 845 struct metapath *mp)
b3b94faa5fe596 David Teigland 2006-01-16 846 {
feaa7bba026c18 Steven Whitehouse 2006-06-14 847 struct gfs2_inode *ip = GFS2_I(inode);
feaa7bba026c18 Steven Whitehouse 2006-06-14 848 struct gfs2_sbd *sdp = GFS2_SB(inode);
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 849 loff_t size = i_size_read(inode);
9b8c81d1de4994 Steven Whitehouse 2008-02-22 850 __be64 *ptr;
3974320ca6aa68 Bob Peterson 2017-02-16 851 sector_t lblock;
628e366df11c0a Andreas Gruenbacher 2018-06-04 852 sector_t lblock_stop;
628e366df11c0a Andreas Gruenbacher 2018-06-04 853 int ret;
9b8c81d1de4994 Steven Whitehouse 2008-02-22 854 int eob;
628e366df11c0a Andreas Gruenbacher 2018-06-04 855 u64 len;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 856 struct buffer_head *dibh = NULL, *bh;
9b8c81d1de4994 Steven Whitehouse 2008-02-22 857 u8 height;
7276b3b0c77101 Steven Whitehouse 2006-09-21 858
628e366df11c0a Andreas Gruenbacher 2018-06-04 859 if (!length)
628e366df11c0a Andreas Gruenbacher 2018-06-04 860 return -EINVAL;
b3b94faa5fe596 David Teigland 2006-01-16 861
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 862 down_read(&ip->i_rw_mutex);
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 863
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 864 ret = gfs2_meta_inode_buffer(ip, &dibh);
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 865 if (ret)
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 866 goto unlock;
38084377af4fc8 Andreas Gruenbacher 2018-11-11 867 mp->mp_bh[0] = dibh;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 868
49edd5bf429c40 Andreas Gruenbacher 2018-02-06 869 if (gfs2_is_stuffed(ip)) {
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 870 if (flags & IOMAP_WRITE) {
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 871 loff_t max_size = gfs2_max_stuffed_size(ip);
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 872
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 873 if (pos + length > max_size)
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 874 goto unstuff;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 875 iomap->length = max_size;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 876 } else {
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 877 if (pos >= size) {
49edd5bf429c40 Andreas Gruenbacher 2018-02-06 878 if (flags & IOMAP_REPORT) {
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 879 ret = -ENOENT;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 880 goto unlock;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 881 } else {
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 882 /* report a hole */
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 883 iomap->offset = pos;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 884 iomap->length = length;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 885 goto do_alloc;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 886 }
3974320ca6aa68 Bob Peterson 2017-02-16 887 }
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 888 iomap->length = size;
49edd5bf429c40 Andreas Gruenbacher 2018-02-06 889 }
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 890 iomap->addr = (ip->i_no_addr << inode->i_blkbits) +
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 891 sizeof(struct gfs2_dinode);
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 892 iomap->type = IOMAP_INLINE;
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 893 iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode);
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 894 goto out;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 895 }
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 896
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 897 unstuff:
3974320ca6aa68 Bob Peterson 2017-02-16 898 lblock = pos >> inode->i_blkbits;
3974320ca6aa68 Bob Peterson 2017-02-16 899 iomap->offset = lblock << inode->i_blkbits;
628e366df11c0a Andreas Gruenbacher 2018-06-04 900 lblock_stop = (pos + length - 1) >> inode->i_blkbits;
628e366df11c0a Andreas Gruenbacher 2018-06-04 901 len = lblock_stop - lblock + 1;
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 902 iomap->length = len << inode->i_blkbits;
20cdc1931ee8e0 Andreas Gruenbacher 2017-09-22 903
9b8c81d1de4994 Steven Whitehouse 2008-02-22 904 height = ip->i_height;
9a38662ba4e268 Andreas Gruenbacher 2018-04-16 905 while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height])
ecc30c79157103 Steven Whitehouse 2008-01-28 906 height++;
628e366df11c0a Andreas Gruenbacher 2018-06-04 907 find_metapath(sdp, lblock, mp, height);
9b8c81d1de4994 Steven Whitehouse 2008-02-22 908 if (height > ip->i_height || gfs2_is_stuffed(ip))
9b8c81d1de4994 Steven Whitehouse 2008-02-22 909 goto do_alloc;
3974320ca6aa68 Bob Peterson 2017-02-16 910
628e366df11c0a Andreas Gruenbacher 2018-06-04 911 ret = lookup_metapath(ip, mp);
e8b43fe0c1e035 Andreas Gruenbacher 2017-12-08 912 if (ret)
628e366df11c0a Andreas Gruenbacher 2018-06-04 913 goto unlock;
3974320ca6aa68 Bob Peterson 2017-02-16 914
628e366df11c0a Andreas Gruenbacher 2018-06-04 915 if (mp->mp_aheight != ip->i_height)
9b8c81d1de4994 Steven Whitehouse 2008-02-22 916 goto do_alloc;
3974320ca6aa68 Bob Peterson 2017-02-16 917
628e366df11c0a Andreas Gruenbacher 2018-06-04 918 ptr = metapointer(ip->i_height - 1, mp);
9b8c81d1de4994 Steven Whitehouse 2008-02-22 919 if (*ptr == 0)
9b8c81d1de4994 Steven Whitehouse 2008-02-22 920 goto do_alloc;
3974320ca6aa68 Bob Peterson 2017-02-16 921
628e366df11c0a Andreas Gruenbacher 2018-06-04 922 bh = mp->mp_bh[ip->i_height - 1];
bcfe94139a45fa Andreas Gruenbacher 2018-05-11 923 len = gfs2_extent_length(bh, ptr, len, &eob);
3974320ca6aa68 Bob Peterson 2017-02-16 924
628e366df11c0a Andreas Gruenbacher 2018-06-04 925 iomap->addr = be64_to_cpu(*ptr) << inode->i_blkbits;
628e366df11c0a Andreas Gruenbacher 2018-06-04 926 iomap->length = len << inode->i_blkbits;
628e366df11c0a Andreas Gruenbacher 2018-06-04 927 iomap->type = IOMAP_MAPPED;
0ed91eca1130e6 Andreas Gruenbacher 2018-07-25 928 iomap->flags |= IOMAP_F_MERGED;
9b8c81d1de4994 Steven Whitehouse 2008-02-22 929 if (eob)
7ee66c03e40a57 Christoph Hellwig 2018-06-01 930 iomap->flags |= IOMAP_F_GFS2_BOUNDARY;
3974320ca6aa68 Bob Peterson 2017-02-16 931
3974320ca6aa68 Bob Peterson 2017-02-16 932 out:
628e366df11c0a Andreas Gruenbacher 2018-06-04 933 iomap->bdev = inode->i_sb->s_bdev;
628e366df11c0a Andreas Gruenbacher 2018-06-04 934 unlock:
628e366df11c0a Andreas Gruenbacher 2018-06-04 935 up_read(&ip->i_rw_mutex);
9b8c81d1de4994 Steven Whitehouse 2008-02-22 936 return ret;
9b8c81d1de4994 Steven Whitehouse 2008-02-22 937
9b8c81d1de4994 Steven Whitehouse 2008-02-22 938 do_alloc:
628e366df11c0a Andreas Gruenbacher 2018-06-04 939 iomap->addr = IOMAP_NULL_ADDR;
628e366df11c0a Andreas Gruenbacher 2018-06-04 940 iomap->type = IOMAP_HOLE;
628e366df11c0a Andreas Gruenbacher 2018-06-04 941 if (flags & IOMAP_REPORT) {
49edd5bf429c40 Andreas Gruenbacher 2018-02-06 942 if (pos >= size)
3974320ca6aa68 Bob Peterson 2017-02-16 943 ret = -ENOENT;
628e366df11c0a Andreas Gruenbacher 2018-06-04 944 else if (height == ip->i_height)
628e366df11c0a Andreas Gruenbacher 2018-06-04 945 ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
49edd5bf429c40 Andreas Gruenbacher 2018-02-06 946 else
49edd5bf429c40 Andreas Gruenbacher 2018-02-06 947 iomap->length = size - pos;
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 948 } else if (flags & IOMAP_WRITE) {
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 949 u64 alloc_size;
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 950
967bcc91b04493 Andreas Gruenbacher 2018-06-19 951 if (flags & IOMAP_DIRECT)
967bcc91b04493 Andreas Gruenbacher 2018-06-19 952 goto out; /* (see gfs2_file_direct_write) */
967bcc91b04493 Andreas Gruenbacher 2018-06-19 953
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 954 len = gfs2_alloc_size(inode, mp, len);
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 955 alloc_size = len << inode->i_blkbits;
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 956 if (alloc_size < iomap->length)
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 957 iomap->length = alloc_size;
64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 958 } else {
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 959 if (pos < size && height == ip->i_height)
d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 @960 ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
3974320ca6aa68 Bob Peterson 2017-02-16 961 }
628e366df11c0a Andreas Gruenbacher 2018-06-04 962 goto out;
628e366df11c0a Andreas Gruenbacher 2018-06-04 963 }
628e366df11c0a Andreas Gruenbacher 2018-06-04 964
:::::: The code at line 960 was first introduced by commit
:::::: d505a96a3b16f46455035dc0296bc2da6014e163 gfs2: Further iomap cleanups
:::::: TO: Andreas Gruenbacher <agruenba(a)redhat.com>
:::::: CC: Andreas Gruenbacher <agruenba(a)redhat.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
From: Konstantin Ovsepian <ovs(a)ovs.to>
stable inclusion
from stable-v5.10.227
commit 1f61d509257d6a05763d05bf37943b35306522b1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW
CVE: CVE-2024-49933
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ]
Recently running UBSAN caught few out of bound shifts in the
ioc_forgive_debts() function:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38
shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long
long')
...
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30
shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long
long')
...
Call Trace:
<IRQ>
dump_stack_lvl+0xca/0x130
__ubsan_handle_shift_out_of_bounds+0x22c/0x280
? __lock_acquire+0x6441/0x7c10
ioc_timer_fn+0x6cec/0x7750
? blk_iocost_init+0x720/0x720
? call_timer_fn+0x5d/0x470
call_timer_fn+0xfa/0x470
? blk_iocost_init+0x720/0x720
__run_timer_base+0x519/0x700
...
Actual impact of this issue was not identified but I propose to fix the
undefined behaviour.
The proposed fix to prevent those out of bound shifts consist of
precalculating exponent before using it the shift operations by taking
min value from the actual exponent and maximum possible number of bits.
Reported-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to>
Acked-by: Tejun Heo <tj(a)kernel.org>
Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com>
---
block/blk-iocost.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 2b3bbae302e2..35e10e1c58fe 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -2047,7 +2047,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors,
struct ioc_now *now)
{
struct ioc_gq *iocg;
- u64 dur, usage_pct, nr_cycles;
+ u64 dur, usage_pct, nr_cycles, nr_cycles_shift;
/* if no debtor, reset the cycle */
if (!nr_debtors) {
@@ -2109,10 +2109,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors,
old_debt = iocg->abs_vdebt;
old_delay = iocg->delay;
+ nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1);
if (iocg->abs_vdebt)
- iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1;
+ iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1;
+
if (iocg->delay)
- iocg->delay = iocg->delay >> nr_cycles ?: 1;
+ iocg->delay = iocg->delay >> nr_cycles_shift ?: 1;
iocg_kick_waitq(iocg, true, now);
--
2.39.2
From: Konstantin Ovsepian <ovs(a)ovs.to>
stable inclusion
from stable-v5.10.227
commit 1f61d509257d6a05763d05bf37943b35306522b1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW
CVE: CVE-2024-49933
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ]
Recently running UBSAN caught few out of bound shifts in the
ioc_forgive_debts() function:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38
shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long
long')
...
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30
shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long
long')
...
Call Trace:
<IRQ>
dump_stack_lvl+0xca/0x130
__ubsan_handle_shift_out_of_bounds+0x22c/0x280
? __lock_acquire+0x6441/0x7c10
ioc_timer_fn+0x6cec/0x7750
? blk_iocost_init+0x720/0x720
? call_timer_fn+0x5d/0x470
call_timer_fn+0xfa/0x470
? blk_iocost_init+0x720/0x720
__run_timer_base+0x519/0x700
...
Actual impact of this issue was not identified but I propose to fix the
undefined behaviour.
The proposed fix to prevent those out of bound shifts consist of
precalculating exponent before using it the shift operations by taking
min value from the actual exponent and maximum possible number of bits.
Reported-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to>
Acked-by: Tejun Heo <tj(a)kernel.org>
Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com>
---
block/blk-iocost.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 2b3bbae302e2..35e10e1c58fe 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -2047,7 +2047,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors,
struct ioc_now *now)
{
struct ioc_gq *iocg;
- u64 dur, usage_pct, nr_cycles;
+ u64 dur, usage_pct, nr_cycles, nr_cycles_shift;
/* if no debtor, reset the cycle */
if (!nr_debtors) {
@@ -2109,10 +2109,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors,
old_debt = iocg->abs_vdebt;
old_delay = iocg->delay;
+ nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1);
if (iocg->abs_vdebt)
- iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1;
+ iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1;
+
if (iocg->delay)
- iocg->delay = iocg->delay >> nr_cycles ?: 1;
+ iocg->delay = iocg->delay >> nr_cycles_shift ?: 1;
iocg_kick_waitq(iocg, true, now);
--
2.39.2
From: Konstantin Ovsepian <ovs(a)ovs.to>
stable inclusion
from stable-v6.6.55
commit 1ab2cfe19700fb3dde4c7dfec392acff34db3120
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW
CVE: CVE-2024-49933
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ]
Recently running UBSAN caught few out of bound shifts in the
ioc_forgive_debts() function:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38
shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long
long')
...
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30
shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long
long')
...
Call Trace:
<IRQ>
dump_stack_lvl+0xca/0x130
__ubsan_handle_shift_out_of_bounds+0x22c/0x280
? __lock_acquire+0x6441/0x7c10
ioc_timer_fn+0x6cec/0x7750
? blk_iocost_init+0x720/0x720
? call_timer_fn+0x5d/0x470
call_timer_fn+0xfa/0x470
? blk_iocost_init+0x720/0x720
__run_timer_base+0x519/0x700
...
Actual impact of this issue was not identified but I propose to fix the
undefined behaviour.
The proposed fix to prevent those out of bound shifts consist of
precalculating exponent before using it the shift operations by taking
min value from the actual exponent and maximum possible number of bits.
Reported-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to>
Acked-by: Tejun Heo <tj(a)kernel.org>
Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com>
---
block/blk-iocost.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 3ac79f0c098f..3a5ba10ba2b1 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -2076,7 +2076,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors,
struct ioc_now *now)
{
struct ioc_gq *iocg;
- u64 dur, usage_pct, nr_cycles;
+ u64 dur, usage_pct, nr_cycles, nr_cycles_shift;
/* if no debtor, reset the cycle */
if (!nr_debtors) {
@@ -2138,10 +2138,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors,
old_debt = iocg->abs_vdebt;
old_delay = iocg->delay;
+ nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1);
if (iocg->abs_vdebt)
- iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1;
+ iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1;
+
if (iocg->delay)
- iocg->delay = iocg->delay >> nr_cycles ?: 1;
+ iocg->delay = iocg->delay >> nr_cycles_shift ?: 1;
iocg_kick_waitq(iocg, true, now);
--
2.39.2
Hi Yonglong,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 8dcdd5a432518f8f8deb6ab608551ecda71bda40
commit: c64545e1e5fa4e09603149e918f306562a22a60a [15620/30000] net: hns3: add support for Hisilicon ptp sync device
config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290853.IWsztKim-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290853.IWsztKim-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202410290853.IWsztKim-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=]
731 | static const struct acpi_device_id hisi_ptp_acpi_match[] = {
| ^~~~~~~~~~~~~~~~~~~
vim +/hisi_ptp_acpi_match +731 drivers/ptp/ptp_hisi.c
730
> 731 static const struct acpi_device_id hisi_ptp_acpi_match[] = {
732 { "HISI0411", 0 },
733 { }
734 };
735 MODULE_DEVICE_TABLE(acpi, hisi_ptp_acpi_match);
736
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki